passkeys

[gedw99]

I agree that doing your own auth and auth is nuts.

the code has 2 OIDC based providers currently , and I am contemplating adding Passkeys.

I changed all third parties services I use over to passkeys.
I tried out some basic golang code and it works great on all mobiles and desktops except Window arm.

there is some golang code I can dig out if your interested.

[Darkness4]

If I'm not mistaken, a passkey is not an identity provider?

I don't want my example to be out-of-scope and implement my own identity provider. When using passkeys, you need to store a public key per user, right? I would have to implement a database containing user identities associated with their public keys, which is a big no-no... (I would also have to implement a registration page...).

Well, I could associate the public key with an hash (like with MetaMask), and do it "identity-less", but I think that would be an other type of use-case (that would be interesting though). Flow would be similar to Metamask/Ethereum:

1. The server sends a challenge (a message to be signed) to the authenticator (Metamask, Passkey, etc.).
2. The user signs the challenge with his private key, by interacting with the authenticator. Once the challenge is signed, the user sends his public key and the signed message to the server.
3. Using the public key, the server verifies the signed message and uses the hash of the public key as the user's identity (ethereum uses keccak256).

If you want me to write that example with HTMX and WebAuthn with public key as identity, sure, why not. I've already implemented this kind of flow in other projects (without HTMX). EDIT: Looks like with webauthn, you need to have a user database? Maybe, with simply FIDO? Will see that later... (You can give me some references, if you want) EDIT 2: Looks like the webauthn "ceremonies" need a user ID in the payload, and the authentication step doesn't resend the public key after registration.

Welp, I won't do that flow then.

[gedw99]

It’s all done between the browser and your TPM chip . Both sign up and login.

To me it’s like an auth provider because the Server is NOT doing auth or holding a password that is bcrypyrd, etc.

So yes , our server stores a public key of each user and attenestation type.

[gedw99]

https://github.com/rickh94/templhtmxtodo/blob/main/auth/webauthn.go

It’s a htmx project that looks to be doing passkeys. Am on mobile so cant Check fully right now

[Darkness4]

@gedw99 I did it with the PR #33. I couldn't do it with HTMX though since window.navigator uses JSON and the flow has multiple steps.

[gedw99]

hey @Darkness4 works for me on the test server . Great work !!